Claims Listing 

1. (Currently Amended) A method for investigating messages passed 
in a message-passing environment, the method comprising: 

collecting message traces from at least one participant in the message- 
passing environment, wherein each message trace is a series of messages 
originating from or sent to the at least one participant, ordered by time, wherein 
each message has a first piece describing transfer of information and a second 
piece describing an operation being performed in the message; 

converting identifying information pertaining to the at least one participant 
into an indication of a role played by the at least one participant in the message- 
passing environment; 

assembling the messages into at least one message sequence, wherein 
assembling includes combining multiple message traces into the at least one 
message sequence, each message trace pertaining to one or more messages 
transmitted by, or received at, a participant, wherein the combining is based on 
one or more of, a specified participant, a specified time frame, a transaction 
nature and the role played by the at least one participant; 

analyzing the at least one message sequence from the message-passing 
environment to extract information regarding the at least one participant in the 
message-passing environment, wherein the analyzing comprises comparing at 
least one message sequence with a reference message sequence, the reference 
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message sequence comprises at least one of a sequence that reflects an error- 
free operation in the message passing environment and a sequence that reflects 
known failure conditions in the message passing environment; 

performing cluster analysis to group the at least one message sequence 
into at least one cluster, wherein the cluster analysis includes forming a data 
matrix based on information in the at least one message sequence and forming 
the at least one cluster based on the data matrix , at least one cluster includes the 
reference sequence ; 

sorting into a ranked order at least two clusters based on a number of 
members associated with each cluster, the sorting prioritized from least members 
to most members associated each of the at least two clusters; and 

outputting the information into a table format based on the sorting into a 
ranked order, each cluster represented in the table format is linked to information 
regarding an associated message seguence . 

2. (Original) The method according to claim 1, wherein the 
message-passing environment is a network environment including plural 
participants coupled together via a network. 

3. (Original) The method according to claim 2, wherein the network 
uses an Internet Protocol to transmit messages between participants. 
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4. (Original) The method according to claim 2, wherein the 
messages express the information in one of a plurality of message formats. 

5. (Original) The method according to claim 2, wherein the 
messages include information expressed in a markup language. 

6. (Original) The method according to claim 5, wherein the markup 
language is the extensible markup language (XML). 

7. (Original) The method according to claim 2, wherein the network 
uses Simple Object Access Protocol (SOAP) to transmit messages between 
participants. 

8. (Original) The method according to claim 1, wherein the 
message-passing environment is a machine or system including plural interacting 
components that function as message participants. 

9. (Original) The method according to claim 1, wherein the 
message-passing environment is a software program including plural interacting 
software modules that function as message participants. 

10. and 11. (Canceled) 
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12. (Original) The method according to claim 1, wherein the 
assembling comprises assembling plural message sequences, and the analyzing 
comprises analyzing the plural message sequences. 

13. and 14. (Canceled) 

15. (Previously Presented) The method according to claim 1, wherein the 
forming of the data matrix involves extracting features from said at least one 
message sequence, including extracting numerical counts for at least one feature 
present in the message sequence, the feature including at least one of: a 
message command type, a sender/receiver pair, a property of the message and 
an application-level property. 

16. (Currently Amended) The method according to claim 1 , wherein the 
forming of the data matrix involves forming a similarity measure which measures 
the difference between said at least one message sequence and another 
message sequence, wherein forming a similarity measure includes at l oast ono 
of: string/sequence matching and comparing said at least one message 
sequence with an optimal functioning sequence, a good server trace, a bad 
server trace, and a known sequence from an alternate message-passing 
environment. 
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17. (Previously Presented) The method according to claim 1, wherein the 
analyzing involves identifying results of the cluster analysis that may warrant 
further investigation, wherein the identifying includes comparing the at least one 
message sequence against a formal model of the message passing environment 
and placing the at least one message sequence into one or more clusters 
representing adherence to the formal model, non-adherence to the formal model 
and "interesting", wherein "interesting" includes indicia of beneficial phenomena, 
anomalous conditions, and other features which cause the at least one message 
sequence to be singled out from other message sequences. 

18. (Canceled) 

19. (Original) A computer readable medium including machine 
readable instructions for implementing the collecting, assembling, analyzing, and 
outputting recited in claim 1 . 

20. (Currently Amended) An apparatus for investigating messages 
passed in a message-passing environment, the apparatus comprising: 

message aggregation logic configured to collect a plurality of messages 
from at least one participant in the message-passing environment, and to 
assemble the messages into at least one message sequence, wherein each 
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message has a first piece describing transfer information and a second piece 
describing an operation being performed in the message; 

analysis logic configured to analyze said at least one message sequence 
from the message passing environment to extract information regarding at least 
the one participant in the message-passing environment, wherein the analysis 
logic is further configured to compare said at least one message sequence with a 
reference message sequence, the reference message sequence comprising a 
sequence that reflects an error-free operation in the message passing 
environment; 

cluster analysis logic configured to perform cluster analysis to group the at 
least one message sequence and the reference message sequence into at least 
one cluster, wherein the cluster analysis logic is configured to form a data matrix 
based on information in the at least one message sequence and form the at least 
one cluster based on the data matrix , the cluster analysis logic is configured to 
measure a distance between two or more message seguences of each cluster 
formed by the cluster analysis logic ; and 

output logic configured to output the information as a two-dimensional 
presentation of the at least one cluster and indicating the reference seguence 
and the distance associated with the at least one message seguence . 



Serial No.: 10/692,265 

Atty Docket No.: MS1-1714US 

Atty/Agent: Jacob S. Scott 



-7- 



teeQhay& The Business of IP 



21. (Original) The apparatus according to claim 20, wherein the 
message-passing environment is a network environment including plural 
participants coupled together via a network. 

22. (Original) The apparatus according to claim 21, wherein the 
network uses an Internet Protocol to transmit messages between participants. 

23. (Original) The apparatus according to claim 21, wherein the 
messages express the information in one of a plurality of message formats. 

24. (Original) The apparatus according to claim 21, wherein the 
messages include information expressed in a markup language. 

25. (Previously Presented) The method according to claim 24, wherein 
the markup language is the extensible markup language (XML). 

26. (Original) The apparatus according to claim 21, wherein the 
network uses Simple Object Access Protocol (SOAP) to transmit messages 
between participants. 
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27. (Original) The apparatus according to claim 20, wherein the 
message-passing environment is a machine or system including plural interacting 
components that function as message participants. 

28. (Original) The apparatus according to claim 20, wherein the 
message-passing environment is a software program including plural interacting 
software modules that function as message participants. 

29. (Original) The apparatus according to claim 20, wherein the 
message aggregation logic is further configured to convert identifying information 
pertaining to said at least one participant into an indication of a role played by the 
participant in the message-passing environment. 

30. (Original) The apparatus according to claim 20, wherein the 
message aggregation logic is further configured to combine multiple message 
traces into said at least one message sequence, each message trace pertaining 
to one or more messages transmitted by and/or received at a participant. 

31. (Original) The apparatus according to claim 20, wherein the 
message aggregation logic is further configured to assemble plural message 
sequences, and the analysis logic is further configured to analyze the plural 
message sequences. 
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32. and 33. (Canceled) 



34. (Previously Presented) The apparatus according to claim 20, wherein 
the analysis logic is configured to form the data matrix by extracting features from 
said at least one message sequence. 

35. (Previously Presented) The apparatus according to claim 20, wherein 
the analysis logic is configured to form the data matrix by forming a similarity 
measure which measures the difference between said at least one message 
sequence and another message sequence. 

36. (Previously Presented) The apparatus according to claim 20, wherein 
the analysis logic is further configured to identify results of the cluster analysis 
that may warrant further investigation. 

37. (Canceled) 

38. (Original) A computer readable medium including machine 
readable instructions for implementing the message aggregation logic, the 
analysis logic, and the output logic of claim 20. 
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39. (Currently Amended) An apparatus for investigating messages 
passed in a message-passing environment, the apparatus comprising: 

means for collecting message traces from at least one participant in the 
message-passing environment, wherein each message trace is a series of 
messages originating from or sent to the at least one participant, ordered by time, 
wherein each message has a first piece describing transfer of information and a 
second piece describing an operation being performed in the message; 

means for converting identifying information pertaining to the at least one 
participant into an indication of a role played by the at least one participant in the 
message-passing environment; 

means for assembling the messages into at least one message sequence, 
wherein assembling includes combining multiple message traces into the at least 
one message sequence, each message trace pertaining to one or more 
messages transmitted by, or received at, a participant, wherein the combining is 
based on one or more of, a specified participant, a specified time frame, a 
transaction nature and the role played by the at least one participant; 

means for analyzing the at least one message sequence from the 
message-passing environment to extract information regarding the at least one 
participant in the message-passing environment, wherein the analyzing 
comprises comparing at least one message sequence with a reference message 
sequence, the reference message sequence comprises at least one of a 
sequence that reflects an error-free operation in the message passing 
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environment and a sequence that reflects known failure conditions in the 
message passing environment; 

means for performing cluster analysis to group the at least one message 
sequence and the reference message sequence into at least one cluster, 
wherein the cluster analysis includes forming a data matrix based on information 
in the at least one message sequence and forming the at least one cluster based 
on the data matrix; 

means for storing the at least one message in a master collection of 
message sequences; 

means for culling the master collection of message sequences for at least 
one subset of a message sequence based on specified criteria including one 
[[of]]or more of: a specified time range, transaction type, participants involved in 
at least one message exchange, objectives of an analyst and a nature of the 
message-passing environment involved; and 

means for storing the at least one subset for subsequent analysis; and 

means for outputting the information. 

40. (Canceled) 

41. (Previously Presented) The apparatus according to claim 20, 
wherein the reference message sequence is a sequence that reflects known 
failure conditions within the message passing environment. 

Serial No.: 10/692,265 10 < ^ 4 

Atty Docket No.: MS1-1714US " 1 ^ ^<fjjN $Oy«*i The B'JSifie$S Of IP 

Atty/Agent: Jacob S. Scott 



